Information Security – Iso 27001

[Your Company Name] Understand and owns security/compliance responsibility as distinctive from operational/revenuegenerating responsibilities Their position as Risk Owner for relevant risks: Each department head or other similar figure is ownerof risks that are allocated to them in relevance to their jurisdiction. In ISO 270001 this is distributedby the controls to the respective owner, from a formal document – Statement of Applicability Encourages team members to report security weaknesses or incidents relevant to any part of theorganisationAuthority: To inform management about any new risk/vulnerability Assist with the implementation of policies, performing of assessments, audits and remediation inrelevance to their jurisdictionISMS End Users: Includes employees without departmental/supervisor responsibilitiesComplies to end-user policy/procedure, namely Acceptable Usage Policy, which provides descriptionof each user behaviour with respect to information usage Reports security weakness/incidents to either the head of department or the ISMS security manager. End Users do not exploit known security weaknesses.Authority: To report any new weaknesses/incidents to the head of department/data protection officer/CEOInternal Auditors: Functions upon the directives of the senior management/Security forum and carries out regularreview of ISMS, based on the defined scope. The individuals nominated should be impartial, who has no material benefit in the outcome ofInternal audit, positive or negative. Makes judgment on the effectiveness of the selected policies, procedures and records Individuals will be named on an as needs basis in accordance to their impartibility and availabilityAuthority: To raise non-conformity in any aspect of ISMS operation[Date]

[Your Company Name]Risk Treatment PlanDescriptionYour Company Name has guidelines for all employees regarding the Risk Treatment Plan.Purpose & ScopeThe purpose of this policy is to explain the general procedures relating to the risk treatment plan.The following guidelines are to be adhered to by all employers, supervisors and employees.Policy & ProcedureIn order to achieve the ISMS objectives, the following activities need to be done:Definition ofhazardDescription of activitiesNecessaryfinancial andotherresourcesResponsiblepersonStart andcompletiondeadlines[Date]Training andawarenessprogramsMethod forevaluation ofresultsStatus

[Your Company Name]Management ReviewDescriptionYour Company Name has guidelines for all employees regarding management reviews.Purpose & ScopeThe purpose of this policy is to explain the general procedures relating to management reviews.The following guidelines are to be adhered to by all employers, supervisors and employees.Policy & ProcedureYour Company Name will evaluate the information security performance and the effectives of theinformation security management system.Your Company Name shall determine: What needs to be monitored and measured, including information security processes and controlsThe methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure validresults.When the monitoring and measuring shall be performedWho shall monitor and measure?When the results form monitoringManagement of Your Company Name will review the organisations ISMS at planned intervals to ensure itscontinuing suitability, adequacy and effectiveness.The management review will include consideration of: The status of actions from previous management reviewsChanges in external and internal issues that are relevant to the ISMSFeedback on the information security performance, including trends in:o Nonconformities and corrective actionso Monitoring and measurement resultso Audit resultso Fulfilment of information security objectivesFeedback from interested partiesResults of risk assessment and status of risk treatment planOpportunities for continual improvementThe outputs of the management review shall include decisions related to continual improvementopportunities and any needs for changes to the ISMS. These will be retained as evidence as outlined by clause9.3 under ISO 27001:2013.[Date]

[Your Company Name]List of Threats & VulnerabilitiesDescriptionYour Company Name has guidelines for all employees regarding the list of threats & vulnerabilities. MAUS’policies and procedures as outlined in this document will address these threats or will identify the areaswhere the company will be taking ongoing steps to minimise these threats. While we will always be vigilantand ensure that our applications & systems are designed from the ground up to address these threats andour security protocols, monitoring systems & detection tools are reviewed on a consistent basis, thefollowing threats have been identified.Purpose & ScopeThe purpose of this policy is to explain and outline any relevant threats and vulnerabilities to theorganisation. This is not a definitive list.The following guidelines are to be adhered to by all employers, supervisors and employees.Policy & ProcedureYour Company Name has identified the below possible threats to the business. The company has assessedthe below areas based on severity, likelihood and impact and dealt with these individually. The company forall specific identified threats under the heading Specific Identified Threats Your Company Name willestablish and maintain up-to-date listings of all the legislations and other regulations relevant to YourCompany Name.The below includes some examples of Threats & Vulnerabilities from the ISO 27001:2013 Framework, this listis not exhaustive:Threats: Access to the network by unauthorised persons Bomb attack Bomb threat Breach of contractual relations Breach of legislation Compromising confidential information Concealing user identity Damage caused by a third party Damages resulting from penetration testing Destruction of records Disaster (human caused) Disaster (natural) Disclosure of information Disclosure of passwords Eavesdropping Embezzlement Errors in maintenance Failure of communication links Falsification of records Fire[Date]

[Your Company Name] Flood Fraud Industrial espionage Information leakage Interruption of business processes Loss of electricity Loss of support services Malfunction of equipment Malicious code Misuse of information systems Misuse of audit tools Pollution Social engineering Software errors Strike Terrorist attacks Theft Thunderstroke Unintentional change of data in an information system Unauthorised access to the information system Unauthorised changes of records Unauthorised installation of software Unauthorised physical access Unauthorised use of copyright material Unauthorised use of software User error VandalismVulnerabilities: Complicated user interface Default passwords not changed Disposal of storage media without deleting data Equipment sensitivity to changes in voltage Equipment sensitivity to moisture and contaminants Equipment sensitivity to temperature Inadequate cabling security Inadequate capacity management Inadequate change management Inadequate classification of information Inadequate control of physical access Inadequate maintenance[Date]

[Your Company Name] Inadequate network management Inadequate or irregular backup Inadequate password management Inadequate physical protection Inadequate protection of cryptographic keys Inadequate replacement of older equipment Inadequate security awareness Inadequate segregation of duties Inadequate segregation of operational and testing facilities Inadequate supervision of employees Inadequate supervision of vendors Inadequate training of employees Incomplete specification for software development Insufficient software testing Lack of access control policy Lack of clean desk and clear screen policy Lack of control over the input and output data Lack of internal documentation Lack of or poor implementation of internal audit Lack of policy for the use of cryptography Lack of procedure for removing access rights upon termination of employment Lack of protection for mobile equipment Lack of redundancy Lack of systems for identification and authentication Lack of validation of the processed data Location vulnerable to flooding Poor selection of test data Single copy Too much power in one person Uncontrolled copying of data Uncontrolled download from the Internet Uncontrolled use of information systems Undocumented software Unmotivated employees Unprotected public network connections User rights are not reviewed regularlySpecific Identified Threats:(This list is not exhaustive and should be edited and updated in accordance with changes to internal systemsand processes):Threat 1: Masquerading of user identity by insiders: The threat of masquerading of user identity by insiderscovers attempts by authorised users to gain access to information to which they have not been granted[Date]

[Your Company Name]access. These users may attempt to gain access to that information by using another user’s account or logincredentials.Threat 2: Masquerading of user identity by contracted service Providers: The threat of masquerading of auser identity by contracted service providers covers attempts by people working for a contracted serviceprovider to obtain unauthorised access to information by using an authorised person.Threat 3: Masquerading of user identity by outsiders: The threat of masquerading of a user identity byoutsiders covers attempts by outsiders to obtain unauthorised access to information by posing as anauthorised user.Threat 4: Unauthorised use of an application: Various cases of unauthorised use of an application.Threat 5: Introduction of damaging or disruptive software: This threat covers Viruses, Worms, Trojan Horses,logic bombs, any other form of malicious software which could impact the services of our product/s.Threat 6: Misuse of system resources: Identifies factors that increase the threat of misuse of systemresources; covers People playing games on business systems, People using business systems for personalwork, People downloading non-work-related information from the internet, People setting up databases orother packages for non-work related matters.Threat 7: Communications infiltration: This threat covers the following types of event: Hacking into a systemusing, for example, buffer overflow attacks, masquerading as a server, masquerading as an existing user of anecommerce application, masquerading as a new user of an ecommerce application, Denial of service(deliberate), Flaming attacks, and Spamming.Threat 8: Communications interception: This threat covers Passive interception and Traffic monitoring. Theease of interception is determined by two basic-factors: The medium of transmission and the type ofprotocols being used. Interception of some types of traffic on the internet is relatively easy. It can beachieved by attackers sending messages to target systems instructing them to send traffic via specific(hostile) machines.Threat 9: Communications manipulation: Active interception, Insertion of false messages, Deliberate deliveryout of sequence, Deliberate delay of delivery, Deliberate misrouting. If an attacker can force a message to besent via a hostile host, the attacker may be in a position to intercept, alter and the forward the message.Threat 10: Repudiation: This threat addresses cases of people denying that they sent a message (repudiationof origin), or that they received a message (repudiation of receipt).Threat 11: Communications failure: Unavailability of Service Provider, Failure of data link, Non – delivery ofmessage, Accidental delivery out of sequence, Accidental delay in delivery, Accidental denial of service. TheInternet does not provide a service level agreement. There are no guarantees on how long it will take for amessage to get to a recipient, or even that it will get there, eventually.Threat 12: Embedding of malicious code: Includes email viruses and hostile mobile code (for example hostileActive X applets). Once on a network, they can quickly infect many machines causing significant disruption.Java and Active X raise a range of new security concerns. Users are now running code written by people fromoutside of the organisation, sometimes from unknown sources. This code has often not been tested by theorganisation. There are concerns that hostile code written using these types of techniques could inflictdamage on systems and networks.Threat 13: Accidental misrouting: The threat of accidental misrouting covers the possibility that informationmight be delivered to an incorrect address when it is being sent over a network.Threat 14: Technical failure of host: This threat covers failures of the CPU or other hardware items.[Date]

[Your Company Name]Threat 15: Technical failure of storage facility: This threat covers disk crashes and disk failures.Threat16: Technical failure of Print facility: This questionnaire identifies the factors that increase the threatfor a technical failure of the print facility.Threat 17: Technical failure of network Distribution Component: This threat addresses cases of networkdistribution component

ISO/IEC 27001:2013 Standard. ISO/IEC 27000:2018 Information Security Management Systems – Overview and Vocabulary. ISO/IEC 27002:2013 Code of practice for information security controls. ISO/IEC 27021:2017 Competence requirements for information security managem